CertGrid CertGrid
Hands-on Lab·Ansible

Ansible Permissions, ACLs and File Modes

File modes in YAML have a trap, and it is not quite where most guidance says it is. A leading zero is fine; omitting it is not, because YAML then reads a decimal number and the resulting permissions are nothing like what you wrote. This proves it three ways, then covers recursion, ACLs for what mode cannot express, and where SELinux would sit on a RHEL host.

Automating Administration Guide 35 of 45 Intermediate

This lab is Ubuntu 26.04 and EX294 is a RHEL exam. the file and ansible.posix.acl modules are identical on both. The difference is mandatory access control: RHEL has SELinux and the ansible.posix.selinux, seboolean and sefcontext modules that go with it, while Ubuntu uses AppArmor and ansible_facts['selinux'] reports disabled.

One managed node. Files under /opt/perms and a temporary user are created and removed.
Server NameIP AddressOSRolesCPURAMHDD
ANS-CTL01192.168.0.36Ubuntu 26.04 LTSAnsible Control Node2 Core3 GB50 GB
ANS-A01192.168.0.37Ubuntu 26.04 LTSManaged Node (group: web)2 Core3 GB50 GB

This guide includes

Use this when a file mode written in YAML does not produce the permissions you meant. This matters because the trap is not quite where most guidance says it is - and ACLs are what you need once three subjects are not enough.

Before you start

  1. The configuration this guide assumes

  2. The octal trap is not where you think

  3. Owner, group and recursion

  4. ACLs for what mode cannot express

  5. What would be SELinux on RHEL

Official sources

← All Ansible guides